97 lines
3.2 KiB
PHP
97 lines
3.2 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\InternalApi;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Modules\Company\Models\Company;
|
|
use Modules\Platform\app\Models\LicenseKey;
|
|
use Modules\Warehouse\app\Models\Warehouse;
|
|
use Tests\TestCase;
|
|
|
|
/**
|
|
* Covers CompanySummaryController and VerifyInternalApiSignature.
|
|
*/
|
|
class InternalApiCoverageTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
/**
|
|
* Ensure the internal API rejects empty configuration.
|
|
*/
|
|
public function test_internal_api_rejects_when_secret_is_missing(): void
|
|
{
|
|
config(['platform.internal_api_key' => '']);
|
|
|
|
$this->getJson('/api/internal/companies')->assertUnauthorized();
|
|
}
|
|
|
|
/**
|
|
* Ensure invalid timestamps are rejected.
|
|
*/
|
|
public function test_internal_api_rejects_invalid_timestamp(): void
|
|
{
|
|
config(['platform.internal_api_key' => 'testing-secret']);
|
|
|
|
$this->withHeaders([
|
|
'X-WMS-Timestamp' => 'not-a-date',
|
|
'X-WMS-Signature' => 'bad',
|
|
])->getJson('/api/internal/companies')->assertUnauthorized();
|
|
}
|
|
|
|
/**
|
|
* Ensure expired timestamps are rejected.
|
|
*/
|
|
public function test_internal_api_rejects_expired_timestamp(): void
|
|
{
|
|
config(['platform.internal_api_key' => 'testing-secret']);
|
|
$timestamp = now()->subMinutes(10)->toIso8601String();
|
|
$signature = hash_hmac('sha256', $timestamp . '.', 'testing-secret');
|
|
|
|
$this->withHeaders([
|
|
'X-WMS-Timestamp' => $timestamp,
|
|
'X-WMS-Signature' => $signature,
|
|
])->getJson('/api/internal/companies')->assertUnauthorized();
|
|
}
|
|
|
|
/**
|
|
* Ensure incorrect HMAC signatures are rejected.
|
|
*/
|
|
public function test_internal_api_rejects_invalid_signature(): void
|
|
{
|
|
config(['platform.internal_api_key' => 'testing-secret']);
|
|
$timestamp = now()->toIso8601String();
|
|
|
|
$this->withHeaders([
|
|
'X-WMS-Timestamp' => $timestamp,
|
|
'X-WMS-Signature' => hash_hmac('sha256', $timestamp . '.', 'wrong-secret'),
|
|
])->getJson('/api/internal/companies')->assertUnauthorized();
|
|
}
|
|
|
|
/**
|
|
* Ensure valid signatures return company summaries and relationship counts.
|
|
*/
|
|
public function test_internal_api_returns_company_summary_counts(): void
|
|
{
|
|
config(['platform.internal_api_key' => 'testing-secret']);
|
|
|
|
$company = Company::create(['name' => 'Summary Tenant', 'slug' => 'summary-tenant']);
|
|
User::factory()->create(['company_id' => $company->id]);
|
|
LicenseKey::issueFor($company, 'Summary licence');
|
|
Warehouse::create(['company_id' => $company->id, 'code' => 'SUM', 'name' => 'Summary Warehouse']);
|
|
|
|
$timestamp = now()->toIso8601String();
|
|
$signature = hash_hmac('sha256', $timestamp . '.', 'testing-secret');
|
|
|
|
$this->withHeaders([
|
|
'X-WMS-Timestamp' => $timestamp,
|
|
'X-WMS-Signature' => $signature,
|
|
])->getJson('/api/internal/companies')
|
|
->assertOk()
|
|
->assertJsonPath('companies.0.name', 'Summary Tenant')
|
|
->assertJsonPath('companies.0.users_count', 1)
|
|
->assertJsonPath('companies.0.warehouses_count', 1)
|
|
->assertJsonPath('companies.0.license_keys_count', 1);
|
|
}
|
|
}
|